Response from SuperAwesome Ltd. 


Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 
The Act requires the Commissioner to take account of the development needs of children at different 
ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report Digital Childhood — addressing 
childhood development milestones in the Digital Environment as a starting point in this respect. This 
report draws upon a number of sources including findings of the United Kingdom Council for Child 
Internet Safety (UKCCIS) Evidence Group in its literature review of Children's online activities risks and 


safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s personal data by providers of ISS 
(online services), how appropriate you consider the above age brackets would be (delete as appropriate): 


Very appropriate. These brackets also closely match the demographic buckets we apply in 
SuperAwesome’s technology platform to enable appropriate content and data protections matched to age 
groups. We name these ranges as follows for ease of use: 


3-5 preschool 
6-9 kid 

10-12 tween 
13-16 teen 1 
16-17 teen 2 


Q1A. Please provide any views or evidence on how appropriate you consider the above age brackets 
would be in setting design standards for the processing of children’s personal data by providers of ISS 
(online services), 


When it comes to processing children’s personal data as part of the delivery of digital services, our view is 
that the starting point should always be zero data collection, irrespective of age. We would make few 
distinctions among children 3-12, all of whom should benefit from open and safe access to digital services 
without the collection of personal data. 
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For Teen 1 (13-15) and Teen 2 (16-17), the design code should consider a progressive approach that 
gradually devolves responsibility for online safety from parent to child, informed by the research literature 
on teen’s cognitive development and in particular critical thinking skills. 


Furthermore, parents need to be educated on what kids should be expected to understand and cope with, 
giving them more autonomy as they get older, and equipping them with digital skills and citizenship along 
the way. Parental education therefore ought to form part of the code. 


Q2. Please provide any views or evidence you have on children’s development needs, in an online 
context in each or any of the above age brackets. 


We follow the established literature on the topic, but also collect primary evidence through our PopJam 
social content platform for kids and tweens. Please see our Section 5 (Responsible Design) in our 
attached contribution document for examples. 


The United Nations Convention on the Rights of the Child 
The Data Protection Act 2018 requires the Commissioner to take account of the UK’s obligations under 
the UN Convention on the Rights of the Child when drafting the Code. 


Q3. Please provide any views or evidence you have on how the Convention might apply in the 
context of setting design standards for the processing of children’s personal data by providers of ISS 
(online services) 


Our views are set out below, alongside references to the relevant sections in our attached contribution 


document. 
UN Convention on the Rights of the Child | Applicability to design standards Reference in 
for data processing our document 
Article 5 (parental guidance and a child’s Government should (a) promote Section 2d 
evolving capacities) Governments must digital media literacy among parents, | (Parental! 
respect the rights and responsibilities of and (b) make available resources to involvement); 
parents and carers to provide guidance and | parents on best practices for Section § 
direction to their child as they grow up, so empowering children to make (Responsible 
that they fully enjoy their rights. This must be | intelligent choices when engaging design) 
done in a way that recognises the child’s online. 

increasing capacity to make their own 
choices. 


Data privacy protections for children 
should not unduly limit their ability to 

access digital services or information, 
subject to their safety. 


Section 1 (Age 
verification); 
Section 3 
(Parental 
consent); 
Section 5 
(Responsible 
Design) 


Article 13 (freedom of expression) Every 
child must be free to express their thoughts 
and opinions and to access all kinds of 

information, as long as it is within the law. 


Educational curricula should 
encourage critical thinking and - in 
particular - teach kids to find and 
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assess authoritative information 
sources. 


Article 16 (right to privacy) Every child has | The right to privacy should apply Section 2 

the right to privacy. The law should protect equally to children’s online presence (Privacy 

the child’s private, family and home life, and activities, including their identity, | controls); 

including protecting children from unlawful their browsing behaviour, their Section 4 

attacks that harm their reputation. location, and any inferred data or (Monetisation 

profile data. & Advertising); 

Section 6 
(Platform 
Privacy by 
Design) 


Article 17 (access to information from the Governments should encourage Section 1 (Age 
media) Every child has the right to reliable investment in digital media literacy Verification); 
information from a variety of sources, and programmes for children, so they can | Section 2 
governments should encourage the media to | navigate to and identify authoritative (Privacy 
provide information that children can information sources. Such sources Contrals & 
understand. Governments must help protect | should be accessible to children Notices) 
children from materials that could harm (subject to safety). 
them. 

Services for children should ensure 

their notices are comprehensive and 

understandable by children and 

parents. 


Article 31 (leisure, play and culture) Every Data privacy protections for children Section 1 (Age 
child has the right to relax, play and take should not unduly limit their ability to Verification); 
part in a wide range of cultural and artistic access digital services, subject to Section § 
activities. their safety. (Responsible 
Design) 


The right to play online should be 
balanced against the health of the 
child based on empirical evidence. 


Aspects of design 


The Government has provided the Commissioner with a list of areas which it proposes she should take 
into account when drafting the Code: 


These are as follows: 
e default privacy settings, 
data minimisation standards, 
the presentation and language of terms and conditions and privacy notices, 
uses of geolocation technology, 
automated and semi-automated profiling, 
transparency of paid-for activity such as product placement and marketing, 
the sharing and resale of data, 
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the strategies used to encourage extended user engagement, 

user reporting and resolution processes and systems, 

the ability to understand and activate a child’s right to erasure, rectification and restriction, 
the ability to access advice from independent, specialist advocates on all data rights, and 
any other aspect of design that the commissioner considers relevant. 


tt. © @ @ 


Q4. Please provide any views or evidence you think the Commissioner should take into account when 
explaining the meaning and coverage of these terms in the code. 


Please see our attached contribution document. 

Q5. Please provide any views or evidence you have on the following: 

Q5A. about the opportunities and challenges you think might arise in setting design standards for 
the processing of children’s personal data by providers of ISS (online services), in each or any of the 


above areas. 


Digital services embracing a child-centred design code have a critical opportunity to reverse the current 
wave of concerms about data privacy and to: 


è Build consumer trust 
e Encourage a new generation of well-rounded digital citizens 
è Contribute to teaching children how to think critically 


The challenges are many, but one of the most significant is ensuring the interoperability of the kids’ 
internet with the broader internet built for adults. Government will have an important role in. providing the 
legal framework that enables kids' digital services to enforce their data privacy protections when 
connecting to non-kids technology service providers. 


See also Section 4a (Technologies and legal frameworks for publisher compliance} in our attached 
contribution document. 


Q5B. about how the ICO, working with relevant stakeholders, might use the opportunities presented 
and positively address any challenges you have identified. 


Q5C. about what design standards might be appropriate (ie where the bar should be set) in each or any 
of the above areas and for each or any of the proposed age brackets. 


Q5D. examples of ISS design you consider to be good practice. 


Lego Life 
PopJam 
CBBC Buzz 


Q5E. about any additional areas, not included in the list above that you think should be the subject of a 
design standard. 
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In the attached contribution document we have set out numerous areas that we believe should be 
included in any age-appropriate design standard above and beyond the areas set out above. These 
include: 

e Monetisation & Advertising - how to design data privacy considerations into digital monetization 
for children’s publishers, enabling zero-data advertising delivery and ensuring appropriate content 
and engagement with children. 

e Responsible design - how to build online social communities for children that encourage positive 
behaviours and deliver safety at scale. 

e Platform Privacy by Design - how to design technical infrastructure to build in data privacy and 
security at the infrastructure layer, such as database systems without unique identifiers for 
example. 


Q6. If you would be interested in contributing to future solutions focussed work in developing the content 
of the code please provide the following information. The Commissioner is particularly interested in 
hearing from bodies representing the views of children or parents, child development experts and trade 
associations representing providers of online services likely to be accessed by children, in this respect. 


GE 6 superawesome.com 


Brief summary of what you think you could offer 


e We can provide expertise on the state of technology and operational best practices, as well as 
proven technical solutions, in relation to many of the key areas the Commissioner is looking at, 
including: 

æ Data minimisation strategies for any type of child-directed service 


e How to monetise and how to advertise to children without profiling, including tools to enforce 
zero-data collection across the advertising delivery chain 


e Disclosure and notices in relation to paid-for activities in all marketing channels (including social 
media and influencer marketing) 


e Development of next-generation age verification technologies and services, including advising on 
industry-wide standards that can help propagate data privacy protections for children 


e Best practices in implementing verified parental consent processes and parent portals to enable 
control over children’s personal data 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you consider to be relevant to this call for 
evidence. 


Please see the attached contribution document. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 

Please specify: 

Developer of technology and tools to safe engagement with children 
online. 


